Changeset 281384 in webkit

Timestamp:

Aug 21, 2021, 6:33:10 PM (3 years ago)

Author:

[email protected]

Message:

IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
​https://bugs.webkit.org/show_bug.cgi?id=229375

Source/WebCore:

Reviewed by Brady Eidson.

Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
created internally.

• Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::dispatchEvent):

Source/WTF:

Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.

Reviewed by Brady Eidson.

• wtf/CrossThreadTask.h:

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/CrossThreadTask.h (modified) (2 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/Modules/indexeddb/IDBRequest.cpp (modified) (1 diff)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2021-08-21  Sihui Liu  <[email protected]>
+
+        IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=229375
+
+        Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
+
+        Reviewed by Brady Eidson.
+
+        * wtf/CrossThreadTask.h:
+
 2021-08-20  Mark Lam  <[email protected]>
 

trunk/Source/WTF/wtf/CrossThreadTask.h

@@ -88 +88 @@
 }
 
-template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {
@@ -96 +96 @@
 }
 
-template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
+template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
 CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
 {

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-21  Sihui Liu  <[email protected]>
+
+        IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=229375
+
+        Reviewed by Brady Eidson.
+
+        Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
+        created internally.
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+
 2021-08-21  Zalan Bujtas  <[email protected]>
 

trunk/Source/WebCore/Modules/indexeddb/IDBRequest.cpp

@@ -309 +309 @@
         targets = { this, m_transaction.get(), &m_transaction->database() };
 
-    m_hasPendingActivity = false;
+    if (event.isTrusted())
+        m_hasPendingActivity = false;
 
     {